The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill acts as an incident response assistant that ingests potentially untrusted data from users describing security breaches. This creates a structural attack surface for indirect prompt injection.
Ingestion points: User-provided incident summaries and data category details provided during the 'Guided Mode' or 'Fast Path' intake phases in SKILL.md.
Boundary markers: No programmatic delimiters are used to wrap user input; however, the skill provides a mandatory 'Confidentiality & Input Hygiene' disclaimer at the start of every session to guide safe input practices.
Capability inventory: The skill is authorized to use web_search for regulatory updates and the docx-processing-anthropic tool for generating compliance documents (references/templates.md).
Sanitization: The skill does not implement programmatic sanitization of user input but relies on its internal analytical framework and specific user instructions to mitigate injection risks.
[NO_CODE]: The skill consists entirely of Markdown instructions and reference materials without any bundled executable scripts or binary files, significantly reducing the direct execution risk profile.
[SAFE]: No malicious patterns, such as hardcoded credentials, persistence mechanisms, or obfuscated payloads, were identified. All external references are to legitimate regulatory authorities like the EDPB and the UK ICO. The use of platform tools like web_search is consistent with the skill's stated purpose of providing up-to-date legal guidance.

gdpr-breach-sentinel-oliver-schmidt-prietz